RFR: 8280409: JarFile::verifiableEntry can fail with NPE accessing ze.getName() [v2]

Lance Andersen lancea at openjdk.java.net
Tue Feb 8 18:15:05 UTC 2022


On Tue, 8 Feb 2022 18:06:52 GMT, Lance Andersen <lancea at openjdk.org> wrote:

>> Ah, yes - good catch!
>
> Will do.

> I'm almost tempted to have getInputStream(ZipEntry) be re-specified to throw IAE if the zip entry name is null.

I personally think it is best to continue throw the NPE as that provides symmetry with ZipFile::getInputStream,  aligns with the current javadoc where a null parameter will throw an NPE unless specified elsewhere,  there are existing tests which check for an NPE if JarFile::getInpuStream(null) is called.

-------------

PR: https://git.openjdk.java.net/jdk/pull/7348



More information about the security-dev mailing list